0

Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times. addiu $zero, 0xA as well as move $at, $at

Both instructions seem to be just redundant but I feel like they are there for a reason. Does anyone have any idea what that reason is? My guess is that is trying to avoid an emulated MIPS perhaps? Because it would error on an emulated MIPS but will just be discarded in a real one. Not sure, however.

Here is a snippet from the disassembly of nyaDrop that is particularly confusing.

addiu   $zero, 0xA
move    $at, $at
move    $at, $at
//end of malware

  • 1
    Are you sure that it is code and not data ? – w s Apr 25 at 6:13
  • Well it does try to execute it, so it is probably code. Moreover, the malware starts off with addiu $zero, 0xA. – reallyunknown Apr 25 at 21:04
1

You can write values to the $zero register, it will simply remain zero.

These 3 instructions are NOPs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.